Malicious code in core-js-gns (npm)
The npm package core-js-gns contained malicious code in its postinstall hook that exfiltrated system information and executed remotely-fetched Python code on developer machines. The package name was a typosquat of the legitimate core-js library.
- Disclosed
- Last updated
- Blast radius
- Developers and CI/CD systems installing core-js-gns during npm install operations.
- Ecosystems
- Attack vectors
- Affected entities
- core-js-gnsMalicious npm package mimicking legitimate core-js library
The npm package core-js-gns contained a malicious postinstall hook that executed arbitrary code during installation. The package name mimics the legitimate core-js library, making it a typosquatting attack.
The malicious behavior was implemented in init.js, which performed developer-machine detection via heuristics (checking for Desktop/Documents/Downloads directories) and a 24-hour skip marker. When conditions were met, the script exfiltrated system information including hostname, username, platform, architecture, Node version, OS release, and package metadata to https://core-js-buffer.domaup-com.workers.dev/report.
The installer then fetched an AES-256-GCM encrypted payload from the same attacker-controlled endpoint with TLS verification disabled, decrypted it using a hardcoded seed-derived key, and executed the resulting Python code detached from the parent process. This enabled arbitrary remote code execution on the installer's machine at npm install time.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- core-js-gns
- Domains
- core-js-buffer.domaup-com.workers.dev
Remediation
- Remove core-js-gns from all package.json files and npm installations
- Audit npm install logs and CI/CD systems for evidence of core-js-gns installation
- Review system logs on developer machines that may have installed the package for signs of unauthorized Python execution or network connections to core-js-buffer.domaup-com.workers.dev
- Use npm audit to identify and remove the malicious package from dependency trees
- Implement package name verification and typosquat detection in dependency management workflows
- Consider using npm package lock files and integrity verification to prevent installation of unexpected packages
Sources
- GitHub Advisory GHSA-5gc7-x6gr-fp8x · GitHub Advisory Database
Cite this entry
"Malicious code in core-js-gns (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-core-js-gns-npm-1f3ub3
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package